There isn't really a great way to handle this. If you allow a truely persistent world...then you should be able to be attacked while logged off the game. But if those cases, how effective are your armies / cities at defending themselves? if you don't allow it then it would be simple for people to log off before a battle or something.